Katherine Pratt - Hacking Your Thoughts: Batman Forever meets Black Mirror

Brain-Computer Interface Security

Katherine Pratt presents security and privacy research on consumer brain-computer interface (BCI) devices — EEG headsets marketed for meditation guidance, attention training, gaming, and neurofeedback therapy.

Consumer EEG Device Ecosystem

Devices such as the Emotiv EPOC+, Muse headband, and Neurosky MindWave use consumer-grade dry EEG electrodes to capture brainwave signals transmitted via Bluetooth to companion applications. Pratt reverse engineers the BLE communication protocols and data formats.

Brainwave Data Privacy

EEG signals contain more information than device manufacturers disclose: raw brainwave data can reveal emotional states, cognitive load, attention levels, and in some cases medical conditions (epilepsy markers, ADHD patterns). Pratt analyzes the data privacy policies of commercial BCI platforms.

Attack Scenarios

The talk demonstrates eavesdropping on BLE brainwave data transmissions, manipulating neurofeedback training sessions by injecting false signals, and conducting covert cognitive load measurements using compromised BCI devices to infer user activity and mental state.